Struct ProxyServer 

pub struct ProxyServer { /* private fields */ }

Universal proxy server.

Implementations

impl ProxyServer

pub fn from_config(config: ProxyConfig) -> Self

Create from YAML config file.

pub fn from_yaml_str(yaml: &str) -> Result<Self>

Create from a YAML document: the ProxyConfig plus the transcoding settings it does not hold (error_details:, streaming.ndjson_envelope and response_headers:), applied as with_error_details, with_ndjson_envelope and with_denied_response_headers would. A top-level or streaming: key no setting reads is logged as a warning.

Errors

Invalid YAML, a ProxyConfig that fails validate, an error_details route pattern that is relative or not a valid glob, or a response_headers.deny entry that is not a header name.

pub fn from_file(path: &Path) -> Result<Self>

from_yaml_str on the contents of a file.

Errors

The file cannot be read, or its contents are rejected by from_yaml_str.

pub fn config(&self) -> &ProxyConfig

The configuration this server was created with.

pub fn with_descriptors(self, pool: DescriptorPool) -> Self

Create with an embedded descriptor pool (for sid-proxy backward compat).

pub fn with_auth_decider(self, decider: Arc<dyn AuthDecider>) -> Self

Inject an in-process forward-auth / PDP decision (embedded Tier-2 hook).

The decider gates every proxied request inline and also backs the /verify forward-auth endpoint. Its signature is axum-free (see hooks::AuthDecider), so the embedder never names an HTTP framework.

pub fn with_oidc_backend(self, backend: Arc<dyn OidcBackend>) -> Self

Back the stateless OIDC surface (discovery, JWKS, userinfo) with the embedder’s key/client metadata (embedded Tier-2 hook).

When set, this supersedes the config-driven static oidc_discovery routes. See hooks::OidcBackend.

pub fn with_extra_routes( self, routes: impl IntoIterator<Item = ExtraRoute>, ) -> Self

Register extra stateless routes through an axum-free adapter (embedded Tier-2 hook). See hooks::ExtraRoute / hooks::ExtraRouteHandler.

pub fn with_verify_path(self, path: impl Into<String>) -> Self

Set the path at which the injected AuthDecider answers forward-auth sub-requests (/verify). Independent of any JWT forward_auth config, so a decider-only embedder can place it without a JWT block.

Resolution order for the path: this override, then auth.forward_auth.path from config, then the default /auth/verify.

pub fn with_token_verifier(self, verifier: Arc<dyn TokenVerifier>) -> Self

Verify bearer tokens with the embedder’s own verifier instead of the built-in one (embedded Tier-2 hook).

The JWT middleware keeps everything around the signature check — route policies, the roles claim, claim→header forwarding — and takes the verdict from hooks::TokenVerifier. Use this when the built-in crypto backend is not the one this binary needs: a validated / FIPS module, an HSM, or a verifier the embedder already owns. It is also the way out of Cargo’s feature unification, which makes rust_crypto / aws_lc_rs a property of the whole dependency graph rather than of one binary.

auth.mode must still be "jwt" for the middleware to run; auth.jwt then only configures claim forwarding, and any key source in it is ignored (with a warning), since the verifier owns its own keys.

pub fn with_error_details(self, policy: ErrorDetailsPolicy) -> Self

Choose which transcoded routes return the upstream’s google.rpc.Status details in their error bodies. Every route does by default; see transcode::error::ErrorDetailsPolicy to switch them off globally or per route.

pub fn with_ndjson_envelope(self, enabled: bool) -> Self

Wrap NDJSON stream lines in {"result"} / {"error"} envelopes; see transcode::TranscodeOptions::with_ndjson_envelope.

pub fn with_denied_response_headers( self, names: impl IntoIterator<Item = HeaderName>, ) -> Self

Keep these upstream response metadata keys off the HTTP responses of the transcoded routes; see transcode::TranscodeOptions::with_denied_response_headers.

pub fn router(&self) -> Result<Router>

Build the axum router with all endpoints.

pub async fn serve(&self) -> Result<()>

Start serving on configured address.